execsnoop-nd(8)

NAME
execsnoop-nd - trace process exec() with arguments. Uses Linux SystemTap (non-debuginfo).

SYNOPSIS
execsnoop-nd.stp

DESCRIPTION
This traces exec() from the fork()->exec() sequence, which means it will not catch new processes that only fork(). It will also show every exec(), including those if a process re-execs.

This is a basic version of execsnoop.

REQUIREMENTS
SystemTap.

EXAMPLES

Trace all new processes and arguments via exec():
    # execsnoop-nd.stp

FIELDS

TIME
    Time of the exec(), in human readable format.

PID Process ID.

PPID
    Parent process ID.

COMM
    Process name.

ARGS
    Command line arguments.

OVERHEAD
This reads and processes exec() events and prints a line of output for each. Since the rate of exec() is expected to be low (< 500/s), the overhead is expected to be negligible.

SOURCE
This is from the SystemTap lwtools collection.

    https://github.com/brendangregg/systemtap-lwtools

Also look under the examples directory for a text file containing example usage, output, and commentary for this tool.

OS
Linux

STABILITY
Unstable - in development.

AUTHOR
Brendan Gregg

SEE ALSO
top(1)